The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/triage.py script performs network requests to established security and threat intelligence services including VirusTotal, MalwareBazaar, ThreatFox, URLhaus, and AbuseIPDB. These services are used to retrieve reputation data for file hashes, IPs, and domains, which is a standard and intended function of a malware analysis tool.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted and potentially malicious files. It mitigates the risk of indirect prompt injection by using specialized scripts to extract structured metadata (hashes, strings, PE headers) rather than allowing the agent to execute or directly interpret raw file content. The instructions in SKILL.md further guide the agent to perform evidence-based reasoning on the extracted data.
[DATA_EXPOSURE]: The skill accesses the file system to read the contents of samples provided for analysis. This file access is restricted to the paths explicitly passed to the scripts. Extracted metadata (such as file hashes) is sent to reputable threat intelligence providers, which is consistent with the skill's primary purpose.
[COMMAND_EXECUTION]: The skill provides Python scripts that are executed by the user or agent via the command line. These scripts perform deterministic analysis tasks (hashing, regex matching, PE parsing) without using dangerous functions like eval() or exec() on external data.

malware-analysis